hxxps://discord[.]com/users/1390434731111223371

Analysis

user interaction
yes
max time kernel
32s
max time network
25s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://discord.com/users/1390434731111223371
Sample261003-mfcntaxv2j

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	discord.com
6	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2284	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{E2D58A25-10F2-4DC9-84DD-307937C490A8}	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4712	chrome.exe
4712	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 1776	4712	chrome.exe	91
PID 4712 wrote to memory of 1988	4712	chrome.exe	92
PID 4712 wrote to memory of 1988	4712	chrome.exe	92
PID 4712 wrote to memory of 2284	4712	chrome.exe	93
PID 4712 wrote to memory of 3524	4712	chrome.exe	94
PID 4712 wrote to memory of 3524	4712	chrome.exe	94
PID 4712 wrote to memory of 988	4712	chrome.exe	96
PID 4712 wrote to memory of 988	4712	chrome.exe	96
PID 4712 wrote to memory of 1164	4712	chrome.exe	97
PID 4712 wrote to memory of 1164	4712	chrome.exe	97
PID 4712 wrote to memory of 5144	4712	chrome.exe	98
PID 4712 wrote to memory of 5144	4712	chrome.exe	98
PID 4712 wrote to memory of 6016	4712	chrome.exe	99
PID 4712 wrote to memory of 3544	4712	chrome.exe	100
PID 4712 wrote to memory of 3544	4712	chrome.exe	100
PID 4712 wrote to memory of 5816	4712	chrome.exe	101
PID 4712 wrote to memory of 4580	4712	chrome.exe	105
PID 4712 wrote to memory of 4836	4712	chrome.exe	104
PID 4712 wrote to memory of 4580	4712	chrome.exe	105
PID 4712 wrote to memory of 4836	4712	chrome.exe	104
PID 4712 wrote to memory of 2260	4712	chrome.exe	106
PID 4712 wrote to memory of 1688	4712	chrome.exe	107
PID 4712 wrote to memory of 2260	4712	chrome.exe	106
PID 4712 wrote to memory of 1688	4712	chrome.exe	107
PID 4712 wrote to memory of 4080	4712	chrome.exe	108
PID 4712 wrote to memory of 4080	4712	chrome.exe	108
PID 4712 wrote to memory of 1252	4712	chrome.exe	109
PID 4712 wrote to memory of 1252	4712	chrome.exe	109
PID 4712 wrote to memory of 1328	4712	chrome.exe	110
PID 4712 wrote to memory of 1328	4712	chrome.exe	110
PID 4712 wrote to memory of 5968	4712	chrome.exe	111
PID 4712 wrote to memory of 5968	4712	chrome.exe	111
PID 4712 wrote to memory of 6364	4712	chrome.exe	113
PID 4712 wrote to memory of 6372	4712	chrome.exe	114
PID 4712 wrote to memory of 6380	4712	chrome.exe	115

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://discord.com/users/1390434731111223371
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff833cbc728,0x7ff833cbc734,0x7ff833cbc740
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,841004886178254870,14996204106276863442,262144 --field-trial-handle=1916,i,14187780224887776902,11098564964161500739,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2168,i,7704457426849902612,7236572192292323011,524288 --field-trial-handle=1916,i,14187780224887776902,11098564964161500739,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,15786255013771752593,11535314591847897398,524288 --field-trial-handle=1916,i,14187780224887776902,11098564964161500739,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:13
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,9396838482041812322,10352083286862063869,2097152 --field-trial-handle=1916,i,14187780224887776902,11098564964161500739,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,9524917219976986965,4887668991162174170,2097152 --field-trial-handle=1916,i,14187780224887776902,11098564964161500739,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4676,i,5951107563907355413,16644956005766639287,2097152 --field-trial-handle=1916,i,14187780224887776902,11098564964161500739,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4864,i,7521850133595160804,8069990702127142005,524288 --field-trial-handle=1916,i,14187780224887776902,11098564964161500739,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
  2⤵
  - Modifies registry class
  PID:6016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3208,i,18180683031660930814,1726737859462492093,524288 --field-trial-handle=1916,i,14187780224887776902,11098564964161500739,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:12
  2⤵
  PID:3544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3456,i,3187887306152939297,12436748464761514019,524288 --field-trial-handle=1916,i,14187780224887776902,11098564964161500739,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
  2⤵
  PID:5816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5860,i,16159638534465302783,16924286499729807618,2097152 --field-trial-handle=1916,i,14187780224887776902,11098564964161500739,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5824,i,11500490273686386273,13595390109875237432,2097152 --field-trial-handle=1916,i,14187780224887776902,11098564964161500739,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6072,i,72722858891085106,12153518376098457623,2097152 --field-trial-handle=1916,i,14187780224887776902,11098564964161500739,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6284,i,9882383874573748025,13790062556910971455,2097152 --field-trial-handle=1916,i,14187780224887776902,11098564964161500739,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6548,i,2449357018940821301,17202093590010411786,2097152 --field-trial-handle=1916,i,14187780224887776902,11098564964161500739,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6604,i,11165100548646618677,12152751777649135051,2097152 --field-trial-handle=1916,i,14187780224887776902,11098564964161500739,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6748,i,13339844838493140444,8972430928116635789,2097152 --field-trial-handle=1916,i,14187780224887776902,11098564964161500739,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6596,i,17627219237347951194,16854087021975519466,2097152 --field-trial-handle=1916,i,14187780224887776902,11098564964161500739,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=256,i,17950225976085667232,4168567039345987874,524288 --field-trial-handle=1916,i,14187780224887776902,11098564964161500739,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:14
  2⤵
  PID:6364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6896,i,1801643400443200066,9774580805640274129,524288 --field-trial-handle=1916,i,14187780224887776902,11098564964161500739,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
  2⤵
  PID:6372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5936,i,10233957713726898992,4009802043589439848,524288 --field-trial-handle=1916,i,14187780224887776902,11098564964161500739,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:14
  2⤵
  PID:6380

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5e39398d-8bcd-4b2a-9ae8-4a24556788ec.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5e39398d-8bcd-4b2a-9ae8-4a24556788ec.tmp
Size 5KB
SHA256 8c160c2744b3fc1669e3a5ab216b05ed235e90fdc9428d1b9d7bfeb3cafd9600
MD5 7814b860341823faf2f955f606d7134a
SHA1 687dd4101891f49e57edc40730a18e858f4a3d95
SHA512 be3c7f7bc41c6d24de8658bc8baf07f236fb579a64eb15fa9e432c1098afedbad6c6fc1914259de208d1781c0b915611f87bff07e28ec4b50bf85363eaa7e797
SSDEEP 96:uC0d+6K6ujgRdfB7rsM6/z6boCSl8h4otop593JD9CB65zGyvLscPYwkK1w0j9I7:uC0CvgFrp6peiU23kNVcPYwkswURuP
TLSH
T1A3C10BB1A46C6D7745F6E596B4073A43CE7422B7AD406F54EADA0F1C04E70AC1382637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84cb6bbc-028a-4145-bb3b-124b7974a475.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\84cb6bbc-028a-4145-bb3b-124b7974a475.tmp
Size 5KB
SHA256 8fe8c580d3d2d39a2f3c1680d27fd17269b0e9035199a68818bf2516368e1b5a
MD5 ac89121310123fd4113998c9f0510e67
SHA1 4d478574b96ff3e9ec808028cc8bab4550c15017
SHA512 6ad9229d3ae443d320f8664e73cd2ee836d898281447e006b131e2ba5d056a15447a8972bbdc303e338690837ce978bbcfe17a08c776840592aeaddfdf05d340
SSDEEP 96:MC0d+6K6ujgRdfB7rsM6/z6boCSl8h4otop593JD9CB65zGyvLscPCPkK1w0j9I7:MC0CvgFrp6peiU23kNVcPCPkswURuP
TLSH
T15AC11CB0E46DA87745F7E596B4073A43CE7421B769406F54DADA0F1C14EB0AC1383637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95ced894-67d6-45bf-9dea-69185fd1242b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\95ced894-67d6-45bf-9dea-69185fd1242b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

540a8406-821f-48d2-a982-d914148129a0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\540a8406-821f-48d2-a982-d914148129a0.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

88e813d8-bcf7-4754-a65a-690a66e754ee.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\88e813d8-bcf7-4754-a65a-690a66e754ee.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 488457a0dd464d40de14ce1f6dbcacc61f3063d9c5a238366eb93fc04700990e
MD5 6aa290c261354c80a093c9914eeeb5c3
SHA1 8fe3c521625ad6bfab28083a3aa2fbe4b630b39d
SHA512 4c5996722b5374d41d16a4d8c94266a5dabc1236f852ac6208c9cbb243761b4c4e371df4a8b1417dff65d1ad34a132560910a16396c2a1c2181a8ecff0dbad25
SSDEEP 192:VRbsilwv7IvAPRp2WBHXsb+WNnyGlzE2TTU1pokw8juiyIsnAUgR:VRbsilsU6XTXwxy2UcS3R
TLSH
T1AF328329EE12B93B5CDBC22AED627753E3F5002536942E88E6FC893C20D75DC2217447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 138B
SHA256 5ea4b1e35db3d358f3ba76fbf46d0a0bfa7545866a5dd650a5dac8b7c2e88491
MD5 9051363292c1e0de0012527fe928a641
SHA1 1915b6d5f844314ea1396d263b88ecf6179228fc
SHA512 61f8b3be97d9c1a8fe0c237835652bb036d5af2a19ddc7015436e05e34a908edd5d0d9b83e47488d465bceb3edf3fa852b3ed3da92ce3129acd45939f36572d7
TLSH
T114C02B6BF6440B008F10425103335E0D4B222CDC8CC5C5CEB00734292074E232207FD3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 226B
SHA256 29e935d3ee0618590c45dc0f9dd3ed2e5df7374fcadbeab5bb2d086033837429
MD5 b1e5f6a078b3e431c53717afbbcebcef
SHA1 35fca02d2252838da084e75dac920cedde12c69b
SHA512 ddc205d4fa87f0338e766e516c00964a788d93ac8a2610ccfbd566996fb7018b23ca3a0c184d51ca11d1025ccb091d86a008e36c91f18f536471cdd2a9f6822e
TLSH
T184D097AFE4440B80DEAA8F902A22093E8B25788804999248A103002B8C90E92B903FA3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 233B
SHA256 e87e0b76fe2db8bed313f7d5259c70b2a7547edba8cea90e1cbf082c61b8dd17
MD5 a10a8d020bb163c8e61e1f3d43f165e1
SHA1 d11cf1cde86f51dd6df7a3ef85d2a7a17db16331
SHA512 7d16451cfa1b7d5753856e4209155779abe29fc5facd56d4acc772e42da6c2aad351001d355dcdf874d79c87e5219cb3da760677890e9328b1bca05140e09f48
TLSH
T1B4D0959FD45107C0DF554B511A32057E8B316C880485C1489103301F4870A42A512F63
MD5 SHA1 SHA512 TLSH

Submit Download

af067655-190d-435f-aeda-eeb9b5011266.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\af067655-190d-435f-aeda-eeb9b5011266.tmp
Size 11KB
SHA256 7cf90f60717ea914eb93ccc6033befd5960eb8f4d3021cfe6133523579b6cfa6
MD5 37718b64a06a50e517bbe3f1c3c724fd
SHA1 e079d2a6cd0db714b76cff36bd7b1a38aafeb016
SHA512 9f7cd3c34bc9a2841fe5431b839f218dd2a816efe6d43c0687399577bdbd570eec24fc3f027d7fe60de1d4c244c271d7f0e2060b988ae52f31700822a57400f0
SSDEEP 192:ehu4K6Hr7KxkXqK4I40pUZNCgVLHrKHfFKslH5nXzKD/kH+ErUkKNIxrAfJWf4P9:gujMr7KxkXqKf/pUZNCgVLH2HfgslZnw
TLSH
T15432D927948D9A3F4FECD908CC52AF4B6CF502927778092496FB9D1803957CE214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bdc9101a-94df-4e49-9e8e-0ce2fa41aca2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\bdc9101a-94df-4e49-9e8e-0ce2fa41aca2.tmp
Size 4KB
SHA256 a62aefc44f9b112cc8658c836d4c4aba187d736e4a9d7c8210dba46dc4789a8f
MD5 e10402caef03cae585e96e2703119894
SHA1 0ec0aacb2d423f4a7c1d5f185f770fbbfc498c46
SHA512 4b198f6d4103be7c55bcb72e8381b45c002157ac244cc030bf054dbf821d313f7593036faf339b5db989a6615b0559d3d8b69eb7a1232b06a3e4e235f9db9ff5
SSDEEP 96:uC0d+6K6ujgRdfB7rsM6abCRDotok593bD9CB6RGyvLsTFK1ebQMUpv4a:uC0CvgFrp65DUDNkJVTFseb3UF
TLSH
T1D9A1F931E0A9597B05B6D48AB8423A43CF74617BB951AF44E9ED5E1C24B70BC1382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download